Hackers Revive 2020 FortiGate Flaw to Bypass 2FA

Fortinet has warned that a three-year-old vulnerability, FG-IR-19-283 (or CVE-2020-12812), originally disclosed and patched in July 2020, is being exploited in the wild to bypass two-factor authentication on FortiGate firewalls by changing username capitalization.

The flaw arises from a mismatch: FortiGate treats usernames as case-sensitive, while some LDAP directories, such as Microsoft Active Directory, are case-insensitive, allowing an attacker to log in using a case variation and trigger an LDAP fallback without prompting for 2FA. Fortinet notes that abuse is observed “based on specific configurations” and that attackers can gain admin or VPN access without 2FA under certain setups.

Administrators are advised to upgrade to FortiGate firmware versions 6.0.10, 6.2.4, 6.4.1, or higher, or apply a manual fix by disabling username-sensitivity to force identical handling of all case variants. The article also recommends removing a secondary LDAP Group if not required and provides commands to apply the changes on local accounts.